Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2024, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
cc4fb678689ad3ae5f93a8a0d2a04ab5.exe
Resource
win7-20231215-en
General
-
Target
cc4fb678689ad3ae5f93a8a0d2a04ab5.exe
-
Size
785KB
-
MD5
cc4fb678689ad3ae5f93a8a0d2a04ab5
-
SHA1
0986ae066ecfab007149a657070f8202e75f69bc
-
SHA256
79658843a0028941539f3b437a8d262c78b15e6e58f4b1f7b96bf357b06fa84f
-
SHA512
72602278f015a2abdf1c2ac816622d7c7139da7cc2cccb1727e92ccf39d61636267fa49f164dd66d8da7f205b13a6f3701254472d6cd0c8918cf6b1f8506d1da
-
SSDEEP
12288:YFRc7yGiQ3f3MsgMsM3AdGZmuEEuUscefF+Q/STar6Zv:mYyGi8MsgMrZKNUsR/2
Malware Config
Extracted
redline
cheat
185.222.58.115:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/4208-21-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/4208-21-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation cc4fb678689ad3ae5f93a8a0d2a04ab5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3188 set thread context of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3888 powershell.exe 3888 powershell.exe 3888 powershell.exe 4208 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 4208 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 4208 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3888 powershell.exe Token: SeDebugPrivilege 4208 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3188 wrote to memory of 3888 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 99 PID 3188 wrote to memory of 3888 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 99 PID 3188 wrote to memory of 3888 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 99 PID 3188 wrote to memory of 3920 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 101 PID 3188 wrote to memory of 3920 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 101 PID 3188 wrote to memory of 3920 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 101 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102 PID 3188 wrote to memory of 4208 3188 cc4fb678689ad3ae5f93a8a0d2a04ab5.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc4fb678689ad3ae5f93a8a0d2a04ab5.exe"C:\Users\Admin\AppData\Local\Temp\cc4fb678689ad3ae5f93a8a0d2a04ab5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QTvmNpc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QTvmNpc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9FF9.tmp"2⤵
- Creates scheduled task(s)
PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\cc4fb678689ad3ae5f93a8a0d2a04ab5.exe"C:\Users\Admin\AppData\Local\Temp\cc4fb678689ad3ae5f93a8a0d2a04ab5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208
-